NGINX Gateway Fabric is vulnerable when configured with a Gateway Custom Resource Definition and an authenticated gRPC connection to the NGINX Agent. An authenticated attacker who owns a service account in a namespace can impersonate the NGINX Agent gRPC connection. This allows the attacker to read the TLS private keys of Gateway deployments that reside in another namespace. The issue is a weakness in authentication (CWE-290) and resides in the control plane; it does not affect the data plane traffic.

The vulnerability affects F5 NGINX Gateway Fabric deployments. No specific product versions are listed, so all current releases should be evaluated for remediation until a vendor update is issued.

The CVSS score of 7.1 indicates a medium‑high impact. The EPSS score is not available, but the vulnerability requires the attacker to be authenticated with the platform and to possess a service account that can impersonate the gRPC connection. The attacker can therefore obtain sensitive TLS keys, potentially compromising encrypted communications. The vulnerability is not present in the CISA KEV catalog, which suggests it may not yet have known public exploits but still poses a significant risk due to the sensitivity of the exposed data.